AI cyber security threats: what's changed for UK businesses

For years, the advice was simple: look for the spelling mistakes. That advice has quietly stopped working. Here's how AI has changed the cyber threat to UK businesses, what recent breaches have taught us, and the steps that still keep you safe.

AI tools can now write a perfect email in seconds, in the style of someone you know, mentioning real names, real projects and real deadlines. They can clone a voice from a few seconds of audio. They can help criminals find and exploit weaknesses in software faster than many businesses can install the fix.

Recently, we've been looking at what AI cyber security threats mean for businesses across Leicestershire, Nottinghamshire and Derbyshire, and the practical steps that make the biggest difference.

How many UK businesses are being hit by cyber attacks?

The UK Government's latest Cyber Security Breaches Survey, published in April 2026, found that 43% of UK businesses identified a breach or attack in the past 12 months. That's around 612,000 businesses. Phishing remains the most common attack by a long way, experienced by 38% of businesses.

43% of UK businesses breached or attacked in a year

47% use any form of multi-factor authentication

24% of businesses using AI manage its cyber risk

Small businesses aren't exempt. Micro and small firms still report breaches at a rate of more than four in ten. Criminals using automated, AI-assisted tools don't pick targets by size. They pick them by opportunity.

How AI is changing cyber security threats

The National Cyber Security Centre (NCSC) expects AI to make cyber attacks more frequent and more effective through to 2027. Not because AI has invented brand new attacks, but because it makes the old ones faster, cheaper and far more convincing. Here are the three biggest changes.

1. AI phishing emails with no typos

AI-written phishing emails are fluent, personalised and free of the mistakes we've trained people to look for. A criminal can pull your team's names from LinkedIn, your clients from your website and your year end from Companies House, then write an email that feels completely routine.

The warning signs that still work have nothing to do with spelling. Watch for urgency or pressure, a change to how money moves (new bank details, an unusual payment), and any request to skip the normal process. Teach your team to judge what a message is asking them to do, not how well it's written.

2. Deepfake fraud and voice cloning

In 2024, UK engineering firm Arup lost around £20 million after an employee joined a video call with what appeared to be the company's CFO and other senior colleagues. Every one of them was an AI-generated deepfake. No system was hacked. A person was deceived.

Hearing a familiar voice or seeing a familiar face is no longer proof. That's why every payment request or bank detail change should be verified through a separate channel, such as calling back on a number you already hold.

3. Faster attacks on unpatched systems

When a software flaw is announced, criminals race to use it before businesses install the fix. AI is shrinking that window to days. Verizon's 2026 Data Breach Investigations Report found that exploiting software vulnerabilities is now the most common way attackers get in. It's why the updated Cyber Essentials requirements, introduced in April 2026, keep a firm 14-day deadline for critical updates.

The hidden risk: AI tools your own team uses

There's a second, quieter AI risk: your own staff. Free AI chatbots are genuinely useful, and your team is almost certainly using them already. When client accounts, contracts or customer lists get pasted into an unapproved tool, that data can leave your control, and for accountants, insurers and financial services firms it can quickly become a UK GDPR issue.

Banning AI rarely works. A short AI acceptable use policy and approved, business-grade tools such as Microsoft 365 Copilot are far more effective.

What recent UK cyber attacks teach smaller businesses

2025 brought some of the most damaging cyber attacks the UK has seen:

■     Marks & Spencer took an estimated £300 million hit after attackers reportedly impersonated staff to an IT help desk and persuaded it to reset passwords.

■     The Co-op lost the personal data of all 6.5 million members and expected a full-year earnings hit of around £120 million.

■     Jaguar Land Rover halted production for around five to six weeks. The Cyber Monitoring Centre estimated the cost to the UK economy at £1.9 billion, affecting more than 5,000 organisations, many of them small Midlands suppliers who had done nothing wrong.

The common thread? In most cases, the way in wasn't a failure of expensive technology. It was a phone call, a convincing message or a gap in a process. AI makes those people-focused attacks easier to run and harder to spot.

Why AI threats matter for your cyber insurance

Last month we looked at how insurers have changed what they expect before they pay a claim. Our guide, How Cyber Essentials protects your business & your insurance payout explains it in full.

Insurers are now placing more weight on exactly the controls that stop AI-powered attacks: multi-factor authentication, patching, staff training and tested backups. If the answers on your renewal questionnaire don't match reality, a claim could be reduced or refused. It's also worth checking whether your policy covers money you're tricked into sending, as not every policy does.

5 steps to protect your business from AI cyber threats

1.    Switch on multi-factor authentication everywhere, especially email, Microsoft 365 and remote access. It's now mandatory on cloud services for Cyber Essentials.

2.    Verify every payment change by phone, using a number you already hold. Never act on a request based on email, voice or video alone.

3.    Train your team for the AI era. Swap "spot the typo" for spotting pressure, urgency and unusual requests, and back it up with phishing simulations.

4.    Patch within 14 days, and faster for anything facing the internet, such as firewalls and remote access tools.

5.    Set clear rules for AI use with an AI acceptable use policy and approved tools.

Go deeper: download the free guide

Our guide, Cyber security in the age of AI, covers each AI threat in detail, unpacks the M&S, Co-op, JLR and Arup breaches, explains what a breach really costs, and includes a practical checklist to work through with your leadership team.

Cyber security support in Leicester and the East Midlands

Somerbys IT has been keeping businesses across Leicestershire, Nottinghamshire and Derbyshire safe since 1996. The threats have changed a lot in that time. Our approach hasn't: real people who know your business, giving honest advice in plain English.

We help local businesses with Cyber Essentials and Cyber Essentials Plus certification, staff training and phishing simulations, multi-factor authentication and email security, backup and recovery, safe AI adoption, and completing the cyber sections of insurance renewal questionnaires. Find out more about our IT security services.

Frequently asked questions

How is AI used in cyber attacks?

Criminals use AI to write convincing, personalised phishing emails, clone voices and faces for deepfake fraud, research targets quickly and find unpatched software faster. Mostly, AI makes existing attacks more effective rather than creating new ones.

How can I spot an AI phishing email?

Don't rely on spelling or grammar. Look for urgency, pressure, requests to change bank details or bypass normal processes, and links or login pages you weren't expecting. If in doubt, verify through a channel you already trust.

How do I protect my business from deepfake fraud?

Never approve a payment or bank detail change based on a call, video call or email alone. Call back on a known number, require two people to approve larger payments, and make it safe for staff to challenge urgent requests from senior leaders.

Does Cyber Essentials protect against AI threats?

Cyber Essentials covers the controls that stop most AI-enhanced attacks, including multi-factor authentication and 14-day patching. It's a strong baseline, best combined with staff training and clear payment verification processes.

Book your free IT review

Not sure where your gaps are? Book a free, no-obligation IT review. We'll check your set-up against today's AI cyber security threats and your insurer's expectations, and give you clear, practical next steps.

Book now: www.somerbysit.co.uk/contact-us